Fixed
The bug has been fixed. See the Version Fixed and Additional Information, if applicable, for more information.
Workaround
A workaround to this issue is to use IIS Manager to set the /arcgis/tokens folder to require SSL. This of course requires that a SSL certificate be installed into IIS.